Do I need ISO 42001?
ISO 42001 is voluntary, so no law requires it. You are a candidate for it if you build or deploy AI and your buyers, partners, or regulators are starting to ask how you govern AI, or if you want a certifiable way to show responsible-AI practices. If AI is not core to your product, or no one is asking yet, it can wait.
ISO 42001 is voluntary
No law mandates ISO/IEC 42001. Like ISO 27001, it is a certification you pursue because it is useful, most often because buyers want assurance that you govern AI responsibly. It is not the same as the EU AI Act, which is binding law.
Signs you are ready for it
You build or deploy AI as a core part of your product; enterprise buyers or partners are asking about your AI governance; you operate in or sell to regulated or EU markets; or you already have ISO 27001 and want to extend that management system to AI. Any of these makes ISO 42001 worth planning.
When it can wait
If AI is peripheral to your product, no customer is asking, and you have no EU or regulated exposure, you probably do not need ISO 42001 yet. A lighter step is to adopt AI-governance basics or the NIST AI RMF now and certify later. Keel lets you start governing AI today and formalize when the time comes.
FAQ
Is ISO 42001 required by law?
No. ISO/IEC 42001 is a voluntary management-system standard. Legal obligations for AI come from regulations like the EU AI Act, not from ISO 42001, though ISO 42001 can help you operationalize practices that support such laws.
Should I do ISO 27001 or ISO 42001 first?
Usually ISO 27001 first if you need both, because it establishes the information-security management system. ISO 42001 uses the same structure, so an existing ISMS makes adding AI governance largely reuse.
Get audit-ready with Keel
The AI-native GRC platform for SMBs: one control-and-evidence graph across SOC 2, ISO 27001, HIPAA, PCI DSS, NIST CSF, and more. Start free, no credit card.
Start free